Bitdefender Napoca bare-metal hypervisor 519 Real-mode Hook napoca/kernel/handler.c out-of-bounds write

Summaryinfo

A vulnerability, which was classified as critical, was found in Bitdefender Napoca bare-metal hypervisor 519. The affected element is an unknown function of the file napoca/kernel/handler.c of the component Real-mode Hook Handler. Executing a manipulation can lead to out-of-bounds write. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability appears as CVE-2026-10047. The attack requires local access. There is no available exploit.

Detailsinfo

A vulnerability has been found in Bitdefender Napoca bare-metal hypervisor 519 and classified as critical. This vulnerability affects some unknown functionality of the file napoca/kernel/handler.c of the component Real-mode Hook Handler. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the real-mode hook handler, implemented in napoca/kernel/handler.c. The handler uses a guest-controlled SS:SP-derived offset as an index into the 1MB RealModeMemory buffer without bounds validation. With SS=0xFFFF and ESP=0xFFFF, the computed offset can reach 0x10FFEF, exceeding the RealModeMemory buffer by 65,519 bytes. The IRET frame push can therefore write past the end of the buffer into the hypervisor heap. The product is end-of-life and unsupported when assigned.

The weakness was presented by Sebastián Alba Vives. The advisory is available at bitdefender.com. This vulnerability was named CVE-2026-10047 since 05/29/2026. The exploitation appears to be easy. Local access is required to approach this attack. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 06/08/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Bitdefender

Name

• Napoca bare-metal hypervisor

Version

• 519

License

• commercial

Support

• end of life

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion